redownload pkgs when source hash verification fails (#8500)

* redownload pkgs when source hash verification fails

* changelog

* catch stray io errors reading index

* cleanup TODO

* Update changelog.d/pr-8500

Co-authored-by: Hécate Moonlight <Kleidukos@users.noreply.github.com>

* fix 9.4.2 build

Co-authored-by: Gershom Bazerman <gershom@arista.com>
Co-authored-by: Hécate Moonlight <Kleidukos@users.noreply.github.com>
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>